Bugzilla – Bug 58925
VUL-0: opera: bug collection
Last modified: 2021-10-27 07:51:55 UTC
Hi, this bug report should serve a "nikolaus bag" for all the opera bug reports we have so far. :)
<!-- SBZ_reproduce --> -
bug 57279: "phishing attack" bug 58526: uses vulnerable qt library bug 58923: local file detection bug 58008: does opera use a vulnerable version of libpng? bug 58269: cross-domain cookie spoofing something i missed?
I don§'t think so. So how do we proceed? I suggest updating to the current Opera version (7.54) in STABLE, you can then review the changes and I'll backport if you approve them...
Yes please.
Roger, done
it had some problems , since we are past the Cryptography Freeze for 9.2. I think Juergen Weigert and Lukas are working on that. This also opened the question of changes in crypto software for released products... :/
We have an ok to increase the version of Opera for released products. We just need be reasonably sure that the cryptography was not enhanced (as in "more bits" and "new algorithms").
head of Novell's export review team gives these directions: Date: Fri, 20 Aug 2004 09:54:03 -0600 From: "Lynn Wallace" <llwallace@novell.com> Hello, Juergen. As long as it is a true bug fix (update) and does not enhance (upgrade) the existing crypto or provide new crypto we are ok. By "enhance," we mean providing a higher bit length or upgrading the functionality of the crypto in any way. So, we have to make sure that even if the fix doesn't specifically touch the crypto it doesn't revise the software component so that the crypto is available for use other than the original intention or allow a boost of the bit length. Lastly, we have to make sure the fix doesn't turn the software into crypto-with-a-hole.
One more for the collection... #43923: Opera local file detection
When is the opera security updated planned, Lukas. Do we have a working opera package with all known issues fixed available?
I'm working with "Christian Westgaard" <chrisw@opera.com> on a new build of Opera, containing also all the security bugfixes.
Submitted updated packages; Thomas pls verify
submitted patchfino file: /work/src/done/PATCHINFO/opera.patch.box [...] Security Update: This update resolves various security vulnerabilities in Opera (web-browser). List of vulnerabilities resolved: + spoofing of address bar content + usage of vulnerable Qt library (CAN-2004-0691) + remote detection of local files (GM#009-OP) + usage of vulnerable PNG library (CAN-2004-0597, CAN-2004-0598, CAN-2004-0599) + cross domain cookie spoofing (CAN-2004-0746)
Lukas, did you made some minor tests, like loading a web-page, with the new opera?
hm, was it checked in for stable only?
tests: yes, I performed them, worked fine backport: unfortunately my disk died a horrible death today, so I didn't :( I'll have to reinstall my machine completely which will take some time For the record, you can get updated Opera tarballs here: https://secure.opera.com/desktop/ Login: SuSE Passwd: spas Contact at Opera: christian.westgaard@opera.com
Lukas, hope everything worked well with your reinstall. :) Please let me know when you finished the backporting of the opera patches for older, supported versions.
Unfortunately not yet, I'll get a new disk from SUSE tomorrow.
packages approved...
CVE-2004-0746: CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)